Neil Madden

Another day, another urgent pronouncement on the need to transition to post-quantum cryptography ASAP: this one from the White House, in the form of an Executive Order requiring certain “high value” systems to transition to post-quantum cryptography (PQC)…

This should be old news, but I keep seeing the same mistake crop up, so I thought I’d blog about it and spread awareness.

Java 17 introduced sealed classes, which allow you to explicitly list the allowed sub-types of an interface or base class.

I’m sure by now you’ve all read the news about Anthropic’s new “Mythos” model and its apparently “dangerous” capabilities in finding security vulnerabilities.

One of the most important lessons I’ve learned in security, is that it’s always better to push security problems back to the source as much as possible.

I originally posted this on Mastodon, but I thought I’d add it here too: “What I mean is that if you really want to understand something, the best way is to try and explain it to someone else.

There’s a common misconception among developers that my job, as a (application) Security Engineer, is to just search for security bugs in their code.

When I was writing Rating 26 years of Java changes, I started reflecting on the new HttpClient library in Java 11.

This post covers several topics around collections (sets, lists, maps/dictionaries, queues, etc) that I’d like to see someone explore more fully.

It’s been a while since I’ve written a pure programming post.

I first started programming Java at IBM back in 1999 as a Pre-University Employee.

OK, so you’ve made your JSON-over-HTTP API.

Note: this post will probably only really make sense to cryptography geeks.

tl;dr: yes, contra thingamajig’s law of wotsits.

I decided today to take a look at CloudFlare’s new OAuth provider library, which they apparently coded almost entirely with Anthropic’s Claude LLM: This library (including the schema documentation) was largely written with the help of Claude, the AI model…

Every programmer knows Donald Knuth’s famous quote that “premature optimization is the root of all evil”, from his 1974 Turing Award lecture (pdf).

Wikipedia’s definition of a digital signature is: A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents.

I’ve been slowly reading Brian Cantwell Smith’s “The Promise of Artificial Intelligence” recently.

Galois/Counter Mode, better known as GCM, is very popular way of encrypting data with AES to provide authenticated encryption with associated data (AEAD).

I see a lot of attempts to define encryption schemes for constrained devices with short authentication tags (e.g., 64 bits) using universal hashing.

Happy new year!

I was just reading yet another article on REST API design guidelines.

For better or worse, depending on your perspective, JSON has become a dominant data format and shows no signs of being replaced any time soon.

If you want to learn how to store passwords securely, you could do a lot worse than looking at the OWASP Password Storage Cheat Sheet.

In cryptography, the process of authenticating a user (or app/service) is known as entity authentication or identification (to distinguish it from message authentication or data origin authentication).

Mike Rosulek, Oregon State University.

I enjoyed Hillel Wayne’s recent newsletter about microfeatures they’d like to see in programming languages.

There has been a lot of discussion recently around the LastPass breach, especially with regards to the number of PBKDF2 iterations applied to the master password to derive the vault encryption key.

Just a few quick notes/updates to correct some potentially inaccurate statements that are floating around on Reddit/Twitter etc: The bug only impacts Java 15 and above.

The long-running BBC sci-fi show Doctor Who has a recurring plot device where the Doctor manages to get out of trouble by showing an identity card which is actually completely blank.